# FURRARI: routes for the leaderboard and share links, and permission for X to embed the game.
DirectoryIndex play.php
Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^play\.html$ play.php [L,QSA]
  RewriteRule ^api/(.*)$ api.php?route=api/$1 [L,QSA]
  RewriteRule ^img/([a-z0-9]+)$ api.php?route=img/$1 [L,QSA]
  RewriteRule ^r/([a-z0-9]+)$ api.php?route=r/$1 [L,QSA]
</IfModule>

# let X (and others) show the game inside a post
<IfModule mod_headers.c>
  Header always unset X-Frame-Options
  Header always set Content-Security-Policy "frame-ancestors *"
  <FilesMatch "\.(glb|js|jpg)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
</IfModule>

AddType model/gltf-binary .glb
AddType application/javascript .js

# keep internals private
<FilesMatch "^(config\.php|game\.html|.*\.sqlite.*)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
</FilesMatch>
